From hard refusals to safe-completions: toward output-centric safety training

If a user asks ChatGPT for the minimum energy needed to ignite a firework display, should it give a helpful answer? The user could be preparing for a July 4th display or a research project for school … or build explosives. As a result, giving a helpful answer could be harmless or harmful depending on the user’s (apparent) intent. This kind of prompt is dual-use: a question with unclear intent, where information could be used in benign or malicious ways. Dual-use problems are especially prevalent in risk areas such as biology and cybersecurity.

In the past, production models such as ChatGPT relied on refusal-based safety training: based on the user’s prompt, the model should either fully comply or refuse. While this type of training can work quite well for obviously harmful prompts, it can struggle to handle dual-use prompts like the fireworks example. In that instance, a refusal-trained model makes a binary decision based on how harmful it perceives the prompt to be - and either fully complies (potentially dangerous if the user wants to use the information maliciously), or refuses and says “I’m sorry, I can’t help with that” (unhelpful if the user is truly trying to fix their fireworks display). 

For GPT‑5, we introduced a new form of safety-training - safe completions - which teaches the model to give the most helpful answer where possible, while still maintaining safety boundaries. We find this approach to be more nuanced, supporting better navigation of dual-use questions. 

How it works

Safe-completion centers safety training on the safety of a model’s output, rather than determining a refusal boundary according to the user’s input. Concretely this is implemented through two training parameters: